Best Practices for Contributor Counting on Self-Hosted GitLab with Qodana

[tobias-kellner]

Hi everyone,

We’re evaluating Qodana Contributor Counting on our self-hosted GitLab instance and have a few questions about the setup and operational requirements:

1. Contributor Counting Requirement – Currently, we’re a new Qodana Ultimate Plus cloud customer, and everything runs smoothly without contributor counting enabled. We’re curious if there are any limitations or implications of continuing without configuring it.

2. SSH Keys per Repository – It seems that each GitLab project needs a separate SSH key for contributor counting. Is this correct? Are there recommended strategies for managing this at scale across hundreds of repositories?

3. Automation Limitations – The Qodana Public API does not expose the SSH keys, so fully automating the deploy key setup appears impossible. Are there any official ways to simplify key management or automate this process?

4. Firewall / IP Whitelisting – Our infrastructure blocks outbound SSH by default. We found a published IP address range that Qodana uses for cloud access: Qodana Project Setup. Can you confirm whether this is sufficient for contributor counting, or are there additional ranges for Self-Hosted installations?

5. Public API Enhancements – We’re looking forward to more possibilities with the Qodana Public API. Currently, we can already automate creating new projects, but we would also like to:

   • Retrieve SSH keys for deploy key setup
   • Automate deletion of projects
   • Configure default branches programmatically

We’d love to hear official guidance or recommended best practices for these scenarios!
Thanks in advance!

[brichbash]

Hi,

Questions 1-3

Contributor Counting Requirement

This currently isn't a technical requirement, i.e. you will have access to all Qodana features even if your Qodana projects don't have a git repository linked to it.

It seems that each GitLab project needs a separate SSH key for contributor counting. Is this correct?

Yes, we recommend setting up SSH keys with as limited permission scope as possible, i.e. limiting each key only to one repo and don't giving it organization-scope access.

Automation Limitations

We're aware of the problem, and currently there are no official ways to automate this process. We have this feature request on our tracker. If you have a spare minute, please vote for it and, if possible, leave a comment describing your use case there. It would help us with prioritizing it.

Question 4

Can you confirm whether this is sufficient for contributor counting, or are there additional ranges for Self-Hosted installations?

Yes, whitelisting the mentioned range is enough for Qodana Cloud to be able to count contributors.

Question 5

Retrieve SSH keys for deploy key setup

This is covered by the issue I shared earlier.

For rest, I've created new feature requests:

• QD-13617 Public API: Set default branch
• QD-13616 Public API: Delete project

[tobias-kellner]

Thank you for the quick response. I’ll review the feature requests in the meantime.
For now, I’ll wait for the Public API improvements, as configuring this manually would require more effort than I can invest at the moment.

Please feel free to close this discussion, or keep it open in case other community members are experiencing the same issue.